MCP Security in 2026: The OAuth SDK CVEs, Tested, and How to Lock Down Your Server

MCP security in October 2026 mostly means OAuth. Within two days of each other, both official MCP SDKs, TypeScript and Python, published high-severity advisories for the same flaw: a malicious MCP ser